CVE-2026-89890

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the go7007 media driver. The go7007 snd remove() function releases the v4l2 device reference too early when a userspace process still has the capture PCM open. Because the ALSA card and its PCM callbacks remain active until the last file is closed, the release path can access struct go7007 via pcm->private data and trigger go7007 snd hw free() after the V4L2 release path has already freed the object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.